201209231850 10c4zk

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 814

Metadata

Post ID: 10c4zk
Title: 201209231850 → 2012-09-23 18:50 on A858's clock
Posted (UTC): 2012-09-23 09:50:01
Timezone: UTC+9 · title 18:50 against posted 09:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231850) = 4cf1b8c438fef8cc73fda1747f40c32d (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(814).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 1 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5FE244013A9845A5 5B5752B949C4AB0F 71B51951CC0AA694 F15DBCF3FC696760 BE1AF95B2A1E2664 76F53A3F313B00B4 5C3C35E2D9ED0328 7AFD2E225DA240B0 74D95E1BB7523F2F ACB5234E0D5D061D 32069784FE1B0A5F B08352D0333D3CA7 826DE9067DAAD1D2 34D9E83ACA5C4034 6888264C06E76217 356ACF9128CC4FD4 194822AF943382F6 961D504CF4DBDA4D 76BE78EB1EC11FBA F769F2224A8F5347 47A6600C6309D752 E2936182274571E2 1219FD4023ADBB95 7934FADF96D32468 7D09F65724A863C2 30463B66781E6877 25A6F6E0062FC778 45761C40F226DE07 E8A28743F69BF9B2 E73037D45D756328 FAE6C2C7E3096B81 7A139DECEDEFE118 C3F19D20171A8B3B 226952AB2F17EBFA 724C1B5318898BC4 36CA584289945230 5D4FB4E0E11EF9ED

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231850 (name+title). Key = MD5(password) = 4cf1b8c438fef8cc73fda1747f40c32d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0b8d0d1a-8979-8d63-9fa1-7bfe145852e5
  2 18208ab2-a3df-5392-8ab0-13eb4450d1ae
  3 c1e1c2db-fe92-6bd0-8873-7528b5e44882
  4 edf086d2-3c9c-2e37-b85d-7f89f44138fc
  5 b67dc7b1-b500-639f-98f9-393dfd7e0f51
  6 14da34bb-e519-8876-8a78-161cfb40d6a8
  7 0969770f-4e23-57b0-92dd-647863af7c63
  8 ad8f473c-2b03-7ea7-ad4f-84b98f92b419
  9 0964c547-6bc1-6af7-b02d-e0e77dbcef78

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 856268576. Exactly this sequence comes out of new Random(814).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related